U.S. Dept Of Defense: Reflected XSS on ███████

Summary: Reflected Cross site Scripting XSS on████leaving.html?url=%22%3E%3Cscript%3Ealertdocument.domain%3C/script%3E Steps To Reproduce: 1. Navigate to███leaving.html?url= 2. Enter a crafted XSS payload like "alert"xss by nagli" 3. Alert will pop :- █████████ How can the system be exploited wit...

Remote code execution

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the...

CVE-2020-9229

Summary: CVE-2020-9229 is an information-disclosure vulnerability in Huawei FusionCompute 8.0.0. The issue stems from failing to protect certain information, allowing an attacker to obtain information. Affected product: Huawei FusionCompute 8.0.0 (VRM/CNA components mentioned in CNVD entry). Root...

Microsoft Excel Information Disclosure Vulnerability (CNVD-2020-49029)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. An information disclosure vulnerability exists in Microsoft Excel. An attacker can exploit this vulnerability to compromise a user's computer or data with the help of specially crafted files...

Microsoft Word Remote Code Execution Vulnerability (CNVD-2021-11036)

Microsoft Word is a word processing software in the Office suite of the U.S. company Microsoft Microsoft. A remote code execution vulnerability exists in Microsoft Word, which arises from the program's failure to properly handle memory objects and can be exploited by an attacker to execute code...

EUVD-2020-27663

Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream...

WebChess SQL Injection Vulnerability

WebChess is a web-based online chess game. A SQL injection vulnerability exists in WebChess version 1.0. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit this vulnerability to execute illegal SQL command...

SpryMedia DataTables SQL Injection Vulnerability

SpryMedia DataTables is a British SpryMedia company for the conversion of HTML tables into dynamic tables of JavaScript library . A SQL injection vulnerability exists in the 'start' and 'length' parameters of the Records.php file in SpryMedia DataTables. A remote attacker can exploit this...

SUSE-SU-2020:1164-2 Security update for LibVNCServer

This update for LibVNCServer fixes the following issues: - CVE-2019-15690: Fixed a heap buffer overflow bsc1160471. - CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory bsc1155419. - CVE-2019-20788: Fixed a integer overflow and heap-based buffer...

Google Android Framework elevation of privilege vulnerability (CNVD-2020-43684)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA, of which Framework is a component of the Android framework. There is a security vulnerability in Framework in Android. An attacker can exploit the vulnerability to elevate privileges...

TP-Link TL-WR740N and TL-WR740ND Injection Vulnerability

The TP-Link TL-WR740N and TP-Link TL-WR740ND are both wireless routers from China's P&L TP-Link. A security vulnerability exists in TP-Link TL-WR740N v4 and TL-WR740ND v4. The vulnerability can be exploited by an attacker to inject HTML code and change the HTML context of target pages and sites...

WordPress Input Validation Error Vulnerability (CNVD-2021-24380)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An input validation error vulnerability exists in WordPress that originates from a web system or product that...

Microsoft Store Runtime Elevation of Privilege Vulnerability (CNVD-2021-25014)

Microsoft Store Runtime is an application store software from Microsoft USA. An elevation of privilege vulnerability exists in Microsoft Store Runtime, which arises from a failure of the program to properly handle memory and can be exploited by an attacker to gain elevation of privilege by runnin...

Microsoft Office SharePoint cross-site scripting vulnerability (CNVD-2021-24036)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site scriptin...

Microsoft Windows Runtime Elevation of Privilege Vulnerability (CNVD-2021-22932)

Microsoft Windows Runtime .net framework is an essential functional support library for the Windows operating system from Microsoft. An elevation of privilege vulnerability exists in Microsoft Windows Runtime, which arises from a failure of the program to properly handle objects in memory. The...

Microsoft Office SharePoint Cross-Site Scripting Vulnerability (CNVD-2021-24039)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site scriptin...

Microsoft Windows Security Health Service elevation of privilege vulnerability (CNVD-2021-25974)

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. An elevation of privilege vulnerability exists in Microsoft Windows Security Health Service. An attacker could exploit this vulnerability by logging on to the system and running...

Microsoft Internet Explorer VBScript Engine Remote Code Execution Vulnerability (CNVD-2021-24002)

Microsoft Internet Explorer IE is a Web browser that comes with the Windows operating system from Microsoft Corporation.VBScript Engine is one of the VBScript scripting language engines. A remote code execution vulnerability exists in the way the VBScript Engine handles objects in memory in...

Microsoft Windows Feedback Hub Elevation of Privilege Vulnerability

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. An elevation of privilege vulnerability exists in Microsoft Windows Feedback Hub, which arises from a program's failure to properly handle memory, and can be exploited by an attacker w...

Windows Update Orchestrator Service Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows Update Orchestrator Service improperly handles file operations. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could exploit this vulnerability by running a specially...